[PATCH v2 1/1] ntdll: Fix reading stale Information from IOSB.

[Jinoh Kang]

From: Jinoh Kang

Enforce proper atomic update so that other threads do not read stale
data from IO_STATUS_BLOCK.

Signed-off-by: Jinoh Kang 
---
 dlls/ntdll/unix/unix_private.h | 26 +++++++++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

diff --git a/dlls/ntdll/unix/unix_private.h b/dlls/ntdll/unix/unix_private.h
index 795fc148479..fb208f54e45 100644
--- a/dlls/ntdll/unix/unix_private.h
+++ b/dlls/ntdll/unix/unix_private.h
@@ -357,6 +357,8 @@ static inline BOOL in_wow64_call(void)

static inline void set_async_iosb( client_ptr_t iosb, NTSTATUS status, ULONG_PTR info )
 {
+    NTSTATUS *status_ptr;
+
     if (!iosb) return;

if (in_wow64_call())
@@ -366,19 +368,37 @@ static inline void set_async_iosb( client_ptr_t iosb, NTSTATUS status, ULONG_PTR
             NTSTATUS Status;
             ULONG    Information;
         } *io = wine_server_get_ptr( iosb );
-        io->Status = status;
+        status_ptr = &io->Status;
         io->Information = info;
     }
     else
     {
         IO_STATUS_BLOCK *io = wine_server_get_ptr( iosb );
 #ifdef NONAMELESSUNION
-        io->u.Status = status;
+        status_ptr = &io->u.Status;
 #else
-        io->Status = status;
+        status_ptr = &io->Status;
 #endif
         io->Information = info;
     }
+
+    /* GetOverlappedResultEx() skips waiting for the event/file handle if the
+     * Status field indicates completion, and returns the result from the
+     * Information field.
+     *
+     * Hence, we have to ensure that writes to the Information field are seen
+     * from the other threads *before* writes to the Status field.
+     *
+     * Otherwise, a race condition results: if writing the Status field has
+     * been completed but the subsequent update to the Information field has
+     * not, the application may end up reading stale value from it.
+     *
+     * The race condition can be especially problematic with applications that
+     * use the HasOverlappedIoCompleted() macro in a tight loop to busy-wait
+     * for completion of overlapped I/O.
+     */
+    MemoryBarrier();  /* TODO: consider replacing with a store-release. */
+    *(volatile NTSTATUS *)status_ptr = status;
 }

static inline client_ptr_t iosb_client_ptr( IO_STATUS_BLOCK *io )